CVE-2026-47884: Spring Framework XsltView SSRF and RCE Vulnerability
Summary
CVE-2026-47884: Spring Framework Improper Path Limitation in XsltView. Affects org.springframework:spring-webmvc across 6 version ranges.
< 5.2.25.RELEASE
>= 5.3.0, <= 5.3.49
>= 6.0.0, <= 6.0.30
>= 6.1.0, <= 6.1.28
>= 6.2.0, <= 6.2.19
>= 7.0.0, < 7.0.9
Fixed in 5.2.25.RELEASE or 7.0.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, particularly web applications. It provides comprehensive infrastructure support for developing Java applications. The 'spring-webmvc' module is specifically designed for building web applications using the Model-View-Controller (MVC) design pattern. This module allows developers to create dynamic web pages and manage user interactions effectively. However, certain configurations can expose applications to vulnerabilities, such as the improper path limitation in XsltView, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from the use of XsltView in a Spring MVC application that has a mapping of '/**' for view rendering without explicitly specifying the view name. This can lead to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) attacks, allowing attackers to manipulate server requests and potentially execute arbitrary code on the server. The affected versions include Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 to 5.3.49, 6.0.0 to 6.0.30, 6.1.0 to 6.1.28, 6.2.0 to 6.2.19, and 7.0.0 to 7.0.8.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.2.25.RELEASE5.2.25.RELEASE -
>= 7.0.0, < 7.0.97.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the application or implementing additional validation on the view names to prevent unauthorized access. Ensure that the application does not allow arbitrary view names to be rendered.
Conclusion
CVE-2026-47884 is a critical vulnerability in the Spring Framework that can lead to serious security risks such as SSRF and RCE attacks. It is essential to update to the patched version to safeguard your applications. Utilize tools like Vulert to monitor for vulnerabilities effectively.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2026-47884 is a vulnerability in the Spring Framework that allows for SSRF and RCE attacks due to improper path limitations in XsltView.
Affected versions include Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 to 5.3.49, 6.0.0 to 6.0.30, 6.1.0 to 6.1.28, 6.2.0 to 6.2.19, and 7.0.0 to 7.0.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your pom.xml. You can also check your application on the Vulert playground without signing up.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
If you cannot update immediately, implement additional validation on view names and restrict access to the application to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
